i see posts about this back to 2014 and I don’t see any solutions
the URL in the page source points to:
https://mycrm.com/legacy/upload/F6952BE7-32C5-76F5-3631-851C84ACF10F_myproductimage.jpg
(it automatically appends those numbers and letters to the file name when uploading)
The actual directory is /public/legacy/upload
Going the link in the source code brings a 403 error
uploads folder has .htaccess with this
| Order Deny,Allow | |
|---|---|
| Deny from all |
Any thoughts?
thanks
do you have your document root set to domainname/public ? This will ensure that the URL works properly.
Yes.
DocumentRoot /var/www/crm/public
Hello Vincent,
the issue is within the /public/legacy/.htaccess file:
If you change it from:
RedirectMatch 403 (?i)/+upload
to:
RedirectMatch 403 (?i)/+upload/$
(allow images within the folder, but not the folder itself)
or comment this one out entirely:
# RedirectMatch 403 (?i)/+upload/$
(allow all access to the upload directory)
However, one would have to contemplate the security implications about this.
The upload folder contains an index.html with content that doesn’t give away much.
If one can guess IDs / paths of contents, this is they way to make it publicly accessible - so careful with this approach.
I’ve updated the issue on Github:
Add your comments as well, to get more visibility - CRM without images is a bad idea 
Thanks Bastian. I do not wish to open up security holes so band-aid fixes won’t work.
However I have just tried that to test and it doesn’t work for me.
Failed to load resource: the server responded with a status of 403 (Forbidden)
Do I need to "rebuild htacess files? What is …htacces.swp file?
Is this in your uploads folder?
| Order Deny,Allow | |
|---|---|
| Deny from all |
That’s the “swap” file from some editor - in case the editor crashed our you got disconnected from the SSH shell session.
You can delete it and then double check your .htaccess
It worked right away for me - that’s more of a server thing than SuiteCRM.
What is this? A file? What’s it’s name?
My vhost:
<Directory /var/www/suite89.demo/public>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
Nothing specific about the upload folder.
Order Deny,Allow
Deny from all
Is the .htaccess file in UPLOADS folder.
Interesting.
I don’t have a .htaccess in my upload folder.
Anyway, simple to test: Make a backup and delete it - see whether it works then.
Ah, that fixed it. The images now show.
What should I do with THAT htacess file in upload directory?
It seems to be coming from older versions.
You’re working on an upgraded system?
All the newer 8.8.x, 8.9.x installations don’t contain it - only the older, upgraded once that I’ve just checked.
If you’re steering restrictions of the upload folder from the parents folder .htaccess, you’ve got a redundancy. You don’t need the upload/.htaccess.
What to do, to make the upload folder non accessible for the internet, but for SuiteCRM is a bigger topic, probably best to be followed via this Github ticket.
I will delete it thanks
I commented on the ticket and will follow that
I would point out that the commands:
Order Deny,Allow
Deny from all
are depreciated commands from Old apache (pre 2.x) and are set to deny any access to that folder anyway, so it looks “wrong” either way. Glad you got it solved however.
Regards
Mark
Exactly, you’re right - it’s probably just a tiny fix.
I’ve created an issue for it:
By the way, there was also an .htaccess in the logs directory that prevented me from writing to logs. I deleted that one also
Just working on something else, it seems there is a rebuild htaccess option in the repair menu, that creates this file with these options in it.
Mark
Hello Mark,
true - there are multiple Admin actions / settings from Suite7 in the admin area which don’t apply or wouldn’t be handled in the same way in Suite8 anymore.
In this case, it seemingly creates an issue in a Suite8 system. I’m usually a bit careful with the repair options, other than the (in)famous quick repair & rebuild.
Yes only noticed because a client running Suite on Azure Container keeps having to click the rebuild htaccess for some reason and noticed it contains these depreciated commands.
Mark
Hello everyone!
This problem was introduced after version 8.5.1, cause images work there. Also the images not working is not limited to the products, it also applies to avatars.
The .htaccess thing? I think it is Apache specific. What about those who use nginx?
Yeah, lots of users use nginx to run SuiteCRM.
